CVE-2026-39983
HighCVSS 8.6Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
The basic-ftp library for Node.js prior to version 5.2.1 is vulnerable to FTP command injection via CRLF sequences in file path parameters. An attacker can exploit this to execute arbitrary FTP commands on the server.
Risk Assessment
The risk involves potential takeover of the FTP session by an attacker, leading to unauthorized access, modification, or deletion of files on the FTP server.
Recommendation
Immediately update the basic-ftp library to version 5.2.1 or later, which includes a fix for the FTP command injection vulnerability.
Other vulnerabilities in basic-ftp
See all- CVE-2026-102990High
basic-ftp before version 6.2.1 contains a ReDoS vulnerability in Client.list(). A malicious or compromised FTP server can force quadratic CPU time parsing a directory listing, blocking the Node.js event loop and freezing the process.
- CVE-2026-44240High
The vulnerability in basic-ftp prior to version 5.3.1 allows for client-side denial of service when parsing multiline FTP control responses. A malicious FTP server can send an unterminated response, leading to excessive memory and CPU usage.
Original NVD description (English source)
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS